Undecidability of bounded security protocols

Transcription

1 Unciabilit of boun scurit protocols urgin Licoln itchll Scrov FSP Trnto Ital Jul 999 /5/0 Outlin Goals an motivations Snta an smantics oun protocols Eampl LLF Conclusions Qustions /5/0 otivation Scurit protocols ar ifficult to sign an analz Subtltis involving crptographic primitivs ultipl concurrnt runs Vrification of a simpl protocol ma combin an numbr of ata from vali or abort runs To arss ths problms a varit of formal mthos for scurit has bn vlop olv-yao mol ializ assumptions about crptographic primitivs an nontrministic avrsar /5/0

2 otivation olv-yao ol ssags ar compos of inivisibl abstract valus Encrption is mol in an ializ wa lac-bo mol of ncrption/crption Possibl intrur actions ar non-trministic an appli throughout th protocol Ra an bloc an mssag compos a mssag into parts Gnrat frsh ata whn n Compos a nw mssag from nown an gnrat ata an put it on th ntwor /5/0 4 Snta an Smantics Vocabular or first-orr signatur Contains smbols that can b us Trm Wll-form prssion ovr th signatur Fact first-orr atomic formula ovr th signatur Stat multi-st of facts Transition rwrit rul containing pr- an post conitions Rwrit Rul using istntial quantification F... F... j. G... G thor is a finit st of facts an rwrit ruls of form l r n /5/0 5 [ / ].... φ ψ ψ Snta an Smantics φ is not fr in an othr hpothsis Eistntial limination rul Eistntiall quantifi aiom.φ Som formula ψ w smbol for th that is prsum to ist riv ψ from [/]ø Th si conition mans that th onl hpothsis in th proof that can contain is th hpothsis [/]ø /5/0 6

3 Snta an Smantics Eampl stat S rul R S = { P f a P b} R = P z. Q f z Rsult application of th rul an a nw valu c for z rsult in succssor stat S S = { Q f f a c P b} /5/0 7 oun Protocols fin multi-st rwriting framwor can b us to scrib finit-stat an infinit-stat sstms Using functions it is possibl to scrib computation ovr unboun ata tps { n} { f n } Eas to nco formulas as countr or Turing machins Principal authntication an scrc protocols ar mostl of boun lngth finit-stat sstms Wll-foun thoris sntactic form of a class of wllfoun protocol thoris /5/0 8 oun Protocols Wll-foun thoris Cration consumption prsistnc finitions about how facts ar crat consum an prsrv Protocol thoris fins how initial stats an protocol stps of participants ar mol rols Intrur thoris fins istinction btwn Initialization an I/O composition an Composition ruls Protocol an intrur fins how intrur bhavior is combin with th stps of th othr participants /5/0 9

4 oun Protocols Participants Initialization Thor istributs s an stablishs shar information Rol Gnration Thor fins th rols a principals can act in Protocol Thoris scribs which stps th principals can prform Intrur Two-Phas Intrur Thor Initializs th intrur an scribs actions it can prform /5/0 0 Eampl ham-schror Initialization Thor GOOGUY.. GooGu P EY.. P a GooGu nn GooGu agu nn a /5/0 Eampl ham-schror Rol Gnration Thor ROL GooGu GooGu ROL GooGu GooGu 0 0 /5/0 4

5 5 /5/0 Eampl ham-schror Protocol Thoris an nc nn nc nn nc nc nc nn nc nn R S R S R S /5/0 4 Eampl ham-schror Two-Phas Intrur Thor Initialization Ruls I/O Ruls a a LR C S REC Ri Si /5/0 5 Eampl ham-schror Two-Phas Intrur Thor composition Ruls P nc P EC nc nc nc LR nc nc P EC LR CP

6 Eampl ham-schror Two-Phas Intrur Thor Composition Ruls COP C C C USE C EC C C nc GE. /5/0 6 C 0000 Protocols w/o noncs C if snt thn rspon if snt 0 if snt 0 if snt 0 thn rspon thn rspon 0 thn rspon 00 if snt 0 thn rspon If intrur routs mssag from through - principals C will rval Thrfor to compromis scurit ponntial tim is n an scrc cannot b compromis in polnomial tim Evn without nw noncs cision problm is P an EXP-tim har ut woul not b consir scur unr olv-yao assumptions /5/0 7 /EXP tim harnss Intrur attac tr EXP-tim ponntial tim n whn attac follows on path at a tim EXP-tim ponntial tim n whn attac starts all paths at onc so shortst path is ponntial /5/0 8 6

7 Unciabilit Thorm 4. Th implication problm for istntial Horn clauss without function smbols is unciabl. In particular thr is no algorithm for ciing whthr a st of istntial Horn clauss without function smbols implis a singl atomic formula b b without function smbols or variabls. This thorm has a straight-forwar irct proof bas on aiomatizing a Coo s thorm stl Turing machin tablau. /5/0 9 Unciabilit Protocol thor in rstrict form. i j = stats of agnts = ntwor mssags Prsistnt facts rmov gnt 0 a0 α α j. a β βl Can b writtn as a Horn claus [ ] i α α j β β /5/0 0 l Unciabilit Intrur stors ncrption of all atomic formulas rivabl from a givn Horn thor without function smbols rplaing ths mssags it is tring to carr out an arbitrar uction ut from thorm 4 follows that thr is no algorithm to ci if this uction is succssful or not Thrfor scrc is unciabl /5/0 7

8 LLF LF logical framwor Thr-lvl calculus for objcts familis an ins Offrs a uction sstm to ma proofs Etnsion of th LF logical framwor Linar implication o itiv conjunction & itiv truth /5/0 LLF LLF Linar Logic Framwor a linar logic tool is us to To sarch cutions of a protocol an intrur for protocol flaws Formall vrif proofs of protocol optimizations /5/0 LLF ultist rwriting an LLF Each transition rul can b writtn as n m n m This allows to us linar logic tools for th protocol analsis /5/0 4 8

9 Eampl of Rul nn na. 0 LLF S nc nn loop o- ann o- a0 o- {aatm} a -o tot ns a m -o loop. /5/0 5 Conclusions Scrc is EXP-tim har whn no nw ata not PSPCE har! Othrwis scrc is unciabl vn for rstrict classs of protocols Usful notation for amining olv-yao mol with LLF tools It is possibl to prform lowr-bouns analsis /5/0 6 Rfrncs Unciabilit of boun scurit protocols!""# $"%&' " " & *+++!"!ta-otation for Protocol nalsis.!&$%-.+*+++!"&# Linar Logical Framwor"# '%" '!'%!/+. 0--!'% ""%0.4-0 *++. &#'' & &' 5&' 5"!' 67" ""%*4+-*8**++* /5/0 7 9

10 Qustions. What is th rol of noncs in th unciabilit of scurit protocols? Eplain. For protocols w/o noncs alra non-polnomial tim n to ci scrc EXPTIE-har With an unlimit numbr of noncs scrc bcoms unciabl Intuitiv rasoning oun numbr of noncs arbitrar numbr of protocol runs o nw ata ll possibl combinations can b chc Rsult ciabilit Unboun numbr of noncs an arbitrar numbr of protocol runs ot all possibl runs can b chc Rsult Unciabilit Thortical rasoning Using Horn fragmnts /5/0 8 Qustions. What ar th avantags of using multist rwriting spciall in rgar to th intrur mol us? fin multi-st rwriting framwor can b us to scrib finit-stat an infinit-stat sstms Using functions it is possibl to scrib computation ovr unboun ata tps Eas to nco as countr or Turing machins olv-yao mol on-trministic intrur Ruls can rsmbl intrur actions Ra Sn Compos compos Gnrat rbitrar choic of a rul that can b appli givs nontrminism Intrurs can b rus for iffrnt protocols onl mssag format has to b aapt /5/0 9 Qustions. What os th unciabilt of scrc man for ral protocol instancs? What os it man for mols us for formal vrification? Ral protocol instancs Using unboun numbr of noncs mas it a mutual isavantag as it impossibl for signr to vrif scrc Harr for intrur to unrmin scurit of protocol Formal vrification mols oncs ar abstract an/or limit in most formal vrification mthos Thrfor scrc proofs ar usuall ma on this limit mols but o not trmin th scrc of ral protocols /5/0 0 0